CYBER THREATCAST

Patch Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS deployments affected by CVE-2026-39808 and CVE-2026-25089, and apply Fortinet mitigations by CISA’s July 19 federal deadline where BOD 26-04 applies. CISA added both command-injection flaws to KEV after active exploitation, Defused observed exploitation attempts, and affected releases include multiple 4.2, 4.4, and 5.0 versions. Review logs and internet-facing FortiSandbox assets for signs of crafted HTTP request activity and unauthorized command execution.

Remediate Joomla sites using the JCE plugin for CVE-2026-48907 immediately, then check for rogue editor profiles and executable PHP webshells. CISA added this CVSS 10.0 JCE plugin zero-day to KEV after reported active exploitation, and the flaw can allow unauthenticated attackers to create editor profiles, upload PHP webshells, and achieve remote code execution. Public-facing Joomla administrators should treat affected sites as potentially compromised until reviewed.

Apply Oracle’s May 2026 fix for CVE-2026-46817 on Oracle E-Business Suite 12.2.3 through 12.2.15, especially where the Oracle Payments component is reachable over HTTP. CISA added the flaw to KEV and required federal agencies to remediate within three days after targeted exploitation attempts were observed. Because unauthenticated attackers can remotely compromise Oracle Payments, EBS owners should prioritize exposed payment workflows and review recent HTTP access for signs of targeted proof-of-concept activity.

Prioritize remediation for on-premises Microsoft SharePoint Server CVE-2026-58644 across SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. CISA added the critical unauthenticated deserialization RCE zero-day to KEV after Microsoft reported exploitation in the wild before patches were available. Organizations running on-premises SharePoint should move these systems to the front of emergency change windows and review exposed deployments for suspicious activity.

Find and lock down exposed AI and cloud services targeted by NadMesh, including ComfyUI, Gradio, Docker APIs, Jenkins, Airflow, Elasticsearch, and Kubernetes environments. QiAnXin XLab reports the Go-based botnet uses more than 20 remote code execution paths and targets AWS keys, Kubernetes tokens, and configuration files, with exploitation paths involving MCP JSON-RPC, Kubernetes hostPath abuse, Docker API misuse, Redis persistence, weak SSH/Telnet credentials, Jenkins, Airflow, Superset, and WebLogic deserialization. Cloud and AI platform teams should treat public exposure of these services as an active intrusion risk.